Bug 928450 - IonMonkey: Check for empty ranges after intersecting integer and floating-point ranges. r=nbp

js/src/jit-test/tests/asm.js/bug928450.js

@@ -0,0 +1,6 @@
+(function() {
+    "use asm"
+    function f() {
+        i((1.5 != 2.) ? 3 : 0)
+    }
+})()

js/src/jit/RangeAnalysis.cpp

@@ -389,9 +389,18 @@ Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange)
     // of 1.5, it may have a range like [0,2] and the max_exponent may be zero.
     // When intersecting such a range with an integer range, the fractional part
     // of the range is dropped, but the max exponent of 0 remains valid.
-    if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_)
+    if (lhs->canHaveFractionalPart_ != rhs->canHaveFractionalPart_) {
         refineInt32BoundsByExponent(newExponent, &newLower, &newUpper);
 
+        // If we're intersecting two ranges that don't overlap, this could also
+        // push the bounds past each other, since the actual intersection is
+        // the empty set.
+        if (newLower > newUpper) {
+            *emptyRange = true;
+            return nullptr;
+        }
+    }
+
     return new Range(newLower, newHasInt32LowerBound, newUpper, newHasInt32UpperBound,
                      newFractional, newExponent);
 }